Privacy & Data Protection Policy

Grace Elliston

GCFE Acupuncture Ltd T/A Awareness & Integration

Last updated: 9th January 2026

Your privacy matters. The work offered through Awareness & Integration involves personal, and sometimes sensitive, information. This policy explains what information is collected, why it’s collected, how it’s used, and how it’s protected.

I aim to be transparent, responsible, and respectful in how your data is handled.

What information is collected

Depending on how you engage with the practice, I may collect:

  • Contact details (name, email address, phone number)

  • Appointment and booking information

  • Health and wellbeing information shared during consultations and treatments

  • Clinical notes created as part of your care

  • Payment and invoicing records

  • Website enquiries or form submissions

Health information is treated as confidential and sensitive.

Why this information is collected

Your information is collected in order to:

  • Provide safe, appropriate, and effective care

  • Maintain accurate clinical records

  • Communicate with you about appointments or your treatment

  • Meet professional, legal, and insurance obligations

  • Manage the day-to-day running of the practice

Your data is never collected for unnecessary reasons and is never sold or shared for marketing purposes.

Lawful basis for processing

Under UK data protection law, the lawful bases relied upon are:

  • Consent — you choose to share information with me

  • Healthcare provision — information is necessary for your care

  • Legal and professional obligations — record keeping, insurance, and regulatory requirements

You can withdraw consent at any time, though this may affect the ability to continue treatment.

How your information is stored

Reasonable and appropriate steps are taken to keep your data secure, including:

  • Password-protected devices and accounts

  • Encrypted or secure cloud-based systems

  • Restricted access to client information

  • Careful handling of email and digital communications

Only information relevant to your care is retained.

Data retention

Clinical records are kept for an appropriate period in line with professional best practice and legal guidance.

Typically:

  • Adult records are retained for 7 years after the end of treatment

  • Children’s records are retained until the child reaches adulthood, plus a further period

After this time, records are securely deleted or destroyed.

Working with associate practitioners

Awareness & Integration operates a collaborative model of care

Where appropriate, limited information may be shared with associate practitioners involved in your treatment. This is done solely for the purpose of providing coordinated care and is governed by strict confidentiality and data protection agreements.

Your information is not shared beyond the care team without your knowledge or consent, unless required by law.

Your rights

Under UK GDPR, you have the right to:

  • Access the information held about you

  • Request corrections to inaccurate data

  • Request deletion of your data (where legally possible)

  • Withdraw consent

  • Raise concerns about how your data is handled

Requests can be made in writing and will be responded to within a reasonable timeframe.

Complaints and concerns

If you have concerns about how your data is handled, you are encouraged to raise them directly with me in the first instance.

You also have the right to lodge a complaint with the UK data protection regulator.

Contact

For questions about this policy or how your data is handled, please contact:

Grace Elliston

Awareness & Integration

grace@awarenessintegration.co.uk